1. Field of the Invention
The present invention relates to network security and more particularly to phishing attack management.
2. Description of the Related Art
The terms “phishing” and “brand spoofing” refer to the transmission of an e-mail to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft. In a phishing scam, an e-mail appearing to originate from the legitimate enterprise (whether by the inclusion of a well-known icon or logo, or domain name) directs the user to visit a Web site where the users will be asked to update personal information, such as a password, credit card number, social security number, or bank account number. The Web site, however, merely is an imposter site masquerading for the legitimate Web site for the legitimate enterprise. For the unsuspecting user, valuable confidential information will be revealed to the fraudster.
Government experts and technical experts alike recommend vigilance as a prime means of combatting the phishing scheme. Specifically, experts recommend that end users never reveal private information through a Web site in response to receiving an e-mail requesting the private information, no matter how legitimate the e-mail appears. Rather, experts encourage recipients of such e-mails to directly phone the legitimate enterprise through a previously known telephone number to inquire as to the legitimacy of the e-mail. Even still, many users simply lapse in caution and unwittingly participate as victims in the phishing scam.